CVE Vulnerability Catalog

Plunk is an open-source email platform that, prior to version 0.9.0, did not verify the SNS signature, certificate, or topic ARN for Amazon SNS notifications at the /webhooks/sns endpoint. This allows attackers to forge webhook requests.

n8n-MCP, an MCP server, has an authenticated server-side request forgery vulnerability affecting webhook trigger tools and the n8n API client. This issue exists in versions from 2.18.7 to before 2.50.2 and has been patched in version 2.50.2.

Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered 'PENDING' organization/user accounts.

In versions prior to 1.0.42-hotfix, the CLI flag --address and the NORNICDB_ADDRESS configuration were not correctly passed to the Bolt server configuration, resulting in the server always listening on all interfaces. This exposes the graph database to the local network with default admin:password credentials.

In the pgx PostgreSQL driver for Go, prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar-quoted string literal in the SQL query contains text that would be interpreted as a placeholder, and the value of that placeholder is attacker-controlled.

Directory Traversal vulnerability in fohrloop dash-uploader versions 0.1.0 through 0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, BaseHttpRequestHandler.get_temp_root(), and BaseHttpRequestHandler._post() components.

The openvpn-auth-oauth2 plugin for OpenVPN server has a vulnerability that allows clients not supporting WebAuth/SSO to access the VPN despite being denied by the authentication logic. The issue exists in versions from 1.26.3 to before 1.27.3 when the plugin is deployed in experimental mode.

In ZEBRA, versions prior to 4.4.0 for zebrad and 6.0.0 for zebra-script had an issue with insufficient error handling during sighash computation, which could lead to the acceptance of an invalid hash type. This could create a consensus split between Zebra and zcashd nodes.

In the Linux kernel, a double free of the fcport structure was found in the qla2xxx SCSI driver. The function qla2x00_els_dcmd_sp_free() frees fcport, and a subsequent kref_put() call triggers a second free, potentially causing memory corruption.

In the Linux kernel, the ceph_handle_auth_reply() function in libceph contains an integer overflow vulnerability. The payload_len field from a CEPH_MSG_AUTH_REPLY message is stored as an int, so a value greater than INT_MAX becomes negative, leading to an out-of-bounds memory access. The fix changes the type to u32 and adds additional segment length sanity checks.

In the Linux kernel, libceph's process_message_header() could perform out-of-bounds reads if the message frame was maliciously corrupted so that the control segment length was smaller than the message header size, or a different frame was made to look like a message frame. An explicit bounds check was added before decoding the message header.

A use-after-free vulnerability was fixed in the Linux kernel's kthread mechanism. When a kthread exited via make_task_dead(), it bypassed kthread_exit() and missed affinity_node cleanup, causing memory to be freed while the node was still linked into the global kthread_affinity_list. A subsequent list_del() by another kthread wrote through dangling list pointers into the freed and reused memory, corrupting the pid's rcu.func pointer.

A vulnerability in the Linux kernel related to MAC comparison in the tcp-md5 protocol has been fixed to prevent timing attacks.

A vulnerability has been identified in the Linux kernel affecting the smb_lazy_parent_lease_break_close() function. The opinfo pointer is accessed after the RCU read unlock, leading to race conditions and potential use-after-free.

A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.

RELATE is a web-based courseware package. Prior to commit 2f68e16, there was a timing attack vulnerability in course/auth.py — check_sign_in_key().

ZEBRA, a Zcash node written in Rust, prior to zebrad version 4.3.1 and zebra-script version 5.0.2, failed to validate a consensus rule regarding hash types for V5 transactions, potentially leading to a consensus split. Additionally, for V4 transactions, an incorrect hash type was used, which could also result in a consensus split.

Nhost, an alternative to Firebase, prior to version 0.49.1 automatically linked an incoming OAuth identity to an existing Nhost account when email addresses matched. The issue was that some provider adapters incorrectly populated the email verification field, potentially leading to unauthorized access.

Beauty Parlour Management System v1.1 was found to have a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

PraisonAI prior to version 4.6.34 has a vulnerability in the MCP server that allows an attacker to write files outside the rules directory. This can lead to arbitrary code execution in the user's context.